7 files changed, 12 insertions, 58 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index 422e4036b..261adc808 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-660f35293504f04d744d2d6ab6276a83fff305a3
-660f35293504f04d744d2d6ab6276a83fff305a3
+cfa01c635debb10e05f5ac34d269809c77c582dc
+cfa01c635debb10e05f5ac34d269809c77c582dc
 4213eec74e74de6310c27a40c3e9759a08a73996
 4213eec74e74de6310c27a40c3e9759a08a73996
 openssh_8.1p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 53ad2d699..4a3c8e3f4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+openssh (1:8.1p1-2) UNRELEASED; urgency=medium
+
+  * Drop "Allow flock and ipc syscall for s390 architecture" patch for now;
+    upstream has security concerns with it and it doesn't currently seem to
+    be needed.
+
+ -- Colin Watson <cjwatson@debian.org>  Tue, 22 Oct 2019 11:08:23 +0100
+
 openssh (1:8.1p1-1) unstable; urgency=medium
 
   * New upstream release (https://www.openssh.com/txt/release-8.1):
diff --git a/debian/patches/conch-old-privkey-format.patch b/debian/patches/conch-old-privkey-format.patch
index 25c16526b..e018ac639 100644
--- a/debian/patches/conch-old-privkey-format.patch
+++ b/debian/patches/conch-old-privkey-format.patch
@@ -1,4 +1,4 @@
-From 46352085d71fe406537828a1cee3c2ce896eccb9 Mon Sep 17 00:00:00 2001
+From bbce4380e516e8bfed1ae09af0bc3661e427794a Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Thu, 30 Aug 2018 00:58:56 +0100
 Subject: Work around conch interoperability failure
diff --git a/debian/patches/revert-ipqos-defaults.patch b/debian/patches/revert-ipqos-defaults.patch
index 844b736d7..7fdfe246c 100644
--- a/debian/patches/revert-ipqos-defaults.patch
+++ b/debian/patches/revert-ipqos-defaults.patch
@@ -1,4 +1,4 @@
-From 660f35293504f04d744d2d6ab6276a83fff305a3 Mon Sep 17 00:00:00 2001
+From cfa01c635debb10e05f5ac34d269809c77c582dc Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Mon, 8 Apr 2019 10:46:29 +0100
 Subject: Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP
diff --git a/debian/patches/seccomp-s390-flock-ipc.patch b/debian/patches/seccomp-s390-flock-ipc.patch
deleted file mode 100644
index aaefa9ed4..000000000
--- a/debian/patches/seccomp-s390-flock-ipc.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From cfc30ca51eba79f9f725c22528e3bfec036aa927 Mon Sep 17 00:00:00 2001
-From: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
-Date: Tue, 9 May 2017 10:53:04 -0300
-Subject: Allow flock and ipc syscall for s390 architecture
-
-In order to use the OpenSSL-ibmpkcs11 engine it is needed to allow flock
-and ipc calls, because this engine calls OpenCryptoki (a PKCS#11
-implementation) which calls the libraries that will communicate with the
-crypto cards. OpenCryptoki makes use of flock and ipc and, as of now,
-this is only need on s390 architecture.
-
-Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
-
-Origin: other, https://bugzilla.mindrot.org/show_bug.cgi?id=2752
-Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2752
-Bug-Ubuntu: https://bugs.launchpad.net/bugs/1686618
-Last-Update: 2018-10-19
-
-Patch-Name: seccomp-s390-flock-ipc.patch
----
- sandbox-seccomp-filter.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index b5cda70bb..2f6b0d55b 100644
---- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -194,6 +194,9 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_exit_group
-        SC_ALLOW(__NR_exit_group),
- #endif
-+#if defined(__NR_flock) && defined(__s390__)
-+       SC_ALLOW(__NR_flock),
-+#endif
- #ifdef __NR_futex
-        SC_ALLOW(__NR_futex),
- #endif
-@@ -221,6 +224,9 @@ static const struct sock_filter preauth_insns[] = {
- #ifdef __NR_getuid32
-        SC_ALLOW(__NR_getuid32),
- #endif
-+#if defined(__NR_ipc) && defined(__s390__)
-+       SC_ALLOW(__NR_ipc),
-+#endif
- #ifdef __NR_madvise
-        SC_ALLOW(__NR_madvise),
- #endif
diff --git a/debian/patches/series b/debian/patches/series
index 74cdd2ce3..8c1046a74 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -21,6 +21,5 @@ gnome-ssh-askpass2-icon.patch
 systemd-readiness.patch
 debian-config.patch
 restore-authorized_keys2.patch
-seccomp-s390-flock-ipc.patch
 conch-old-privkey-format.patch
 revert-ipqos-defaults.patch
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index 2f6b0d55b..b5cda70bb 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -194,9 +194,6 @@ static const struct sock_filter preauth_insns[] = {
 #ifdef __NR_exit_group
         SC_ALLOW(__NR_exit_group),
 #endif
-#if defined(__NR_flock) && defined(__s390__)
-        SC_ALLOW(__NR_flock),
-#endif
 #ifdef __NR_futex
         SC_ALLOW(__NR_futex),
 #endif
@@ -224,9 +221,6 @@ static const struct sock_filter preauth_insns[] = {
 #ifdef __NR_getuid32
         SC_ALLOW(__NR_getuid32),
 #endif
-#if defined(__NR_ipc) && defined(__s390__)
-        SC_ALLOW(__NR_ipc),
-#endif
 #ifdef __NR_madvise
         SC_ALLOW(__NR_madvise),
 #endif